Security audit

微博评论分析 SocialDataX 评论洞察

Security checks for vulnerabilities and agentic risk

Overview

The skill is a read-only Weibo comment helper, but it tells agents to run a mutable npm package at latest version with access to the user's SocialDataX API key.

Review this before installing if your agent has broad filesystem or environment access. Use a narrowly scoped SocialDataX API key, prefer a pinned reviewed version of the CLI or preconfigured MCP tool, and run it in an environment that exposes only the needed key and request data.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:30
Finding: Execution of an Unpinned npm Package with Access to API Credentials
Content: View full analysis
" --pretty --source-client socialdatax-skills \ --source-platform clawhub --source-skill socialdatax-weibo-comments npx -y socialdatax-skills@latest weibo comments \ --post-url "" --pretty \ --source-client socialdatax-skills --source-platform clawhub \ --source-skill socialdatax-weibo-comments npx -y socialdatax-skills@latest weibo replies \ --post-id "" --comment-id "" --pretty \ --source-client socialdatax-skills --source-platform clawhub \ --source-skill socialdatax-weibo-comments ``` ```text If the current environment has permission, install or restore automatically. ``` ### Technical Analysis The Skill directs the agent to execute `socialdatax-skills@latest` through `npx -y`. The `@latest` selector does not identify an immutable, previously reviewed package version. Each invocation may therefore download and run a different package release. The `-y` option also suppresses the normal package-installation confirmation. The package executes as local Node.js code with the permissions of the agent process. The Skill requires `SOCIALDATAX_API_KEY`, so the downloaded package is expected to receive or be able to access that credential. The implementation of `socialdatax-skills` is not included in the audited project, preventing verification of: - The package code that ...[truncated 2615 chars]
Remediation: View remediation
... ``` 2. Commit a package lockfile containing registry-resolved URLs and integrity hashes, and use a deterministic installation mechanism such as `npm ci`. 3. Avoid automatic dependency installation or restoration. Require explicit authorization when a package is absent or when its version or integrity differs from the reviewed value. 4. Verify npm publisher provenance and signed build or release metadata where available. 5. Include the client implementation in the audited project, or provide a reproducible source reference for the exact released artifact. 6. Restrict outbound network access to documented SocialDataX endpoints and the minimum endpoints necessary for the requested operation. 7. Run the client in a sandbox with access only to `SOCIALDATAX_API_KEY` and required request data. Remove unrelated environment variables and limit filesystem access. 8. Use a narrowly scoped, revocable API key with usage limits, monitoring, and rotation procedures. 9. Document how the API key, post identifiers, pagination tokens, and returned data are transmitted and retained. 10. Remove `@latest` and update dependencies only through a controlled review process that repeats security analysis before changing the pinned version. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The skill instructs the agent to execute npx -y socialdatax-skills@latest ..., which fetches and runs the newest package version at runtime without pinning to a specific trusted release. If the upstream package is compromised, a malicious version is published, or a dependency supply-chain attack occurs, arbitrary code could execute in the agent environment with access to environment variables such as SOCIALDATAX_API_KEY.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This command again relies on npx -y socialdatax-skills@latest, causing execution of whatever package version is current at invocation time. That creates a supply-chain execution path where a compromised publisher account, malicious update, or dependency hijack can lead to arbitrary code execution and possible exfiltration of secrets from the host.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The reply-fetching example repeats the same unsafe pattern of dynamically executing an unpinned npm package via npx. Because the skill explicitly prefers direct CLI execution, this increases the chance that agents will actually run the unpinned code, making supply-chain compromise more actionable than a purely informational reference.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.